What we collect, and why.

cardkhata (cardkhata.in) is a credit-card statement analyzer for the Indian market, operated from India by the site owner (developer site: ankitbhardwaj.in). For anything in this policy, write to support@cardkhata.in.

• Account details — the email address you sign in with, and your mobile number.
• Optional profile secrets — your date of birth, your first name as printed on the card, and your mobile number, if you choose to save them. They are used for one purpose only: deriving the passwords that open your statement PDFs. They are encrypted at rest and are never displayed back to you or anyone else.
• Statements — the credit-card statement PDFs you forward to your cardkhata address, and the transactions, EMIs, and fees parsed from them.

That is the full list. cardkhata never asks for your bank login, net-banking password, OTPs, or full card number, and has no way to receive them.

Your data is used to parse your statements and show you your own spending analytics — categorised transactions, EMI schedules, fees, and month-to-month comparisons. Nothing else is built on it.

• We do not sell your data, and we do not share it with advertisers or data brokers.
• It is shared only with the payment gateway (to bill your subscription) and with the infrastructure providers that run the service (such as AWS, where statements are stored), strictly as needed to operate cardkhata.

Subscription payments are processed by third-party payment gateways (Razorpay and/or Cashfree). Your card or UPI details are entered on the gateway’s own checkout and go directly to the gateway — they never touch cardkhata’s servers. PCI compliance for payment data is handled by the gateway. The plan and price are always shown to you before you pay.

• Profile secrets used for PDF passwords are encrypted at rest.
• Forwarded statement PDFs are stored encrypted in cloud storage.
• Access is limited to what the service needs to parse and display your statements.

No system is perfectly secure, but the design principle throughout is to hold as little as possible and to encrypt what must be held.

On our public pages only — the home page, About, the blog, Contact and the policy pages — we use Google Analytics to count visits and see which pages people read. It is off until you say yes: we ask once, and until you allow it no analytics cookie is set and no request is made to Google at all.

• Nothing runs on your signed-in pages. Your statements, cards, spending, reports and rewards are never measured, and no page view from them is ever sent to Google.
• We never send your transactions, card numbers, statement contents or email address to Google. What it receives is ordinary web-visit data: the public page viewed, a rough location from your IP, and your browser and device type.
• We run no advertising. Advertising and personalisation signals are switched off explicitly, not merely left unset, so no advertising profile is built from your visit.
• Saying no is remembered in your browser, and nothing loads on later visits. To change your mind either way, clear this site’s data in your browser and we’ll ask again.

Cookies we set ourselves, to keep you signed in and to remember your theme, are essential to the service working and are not used to track you across other sites.

• You choose what to forward — cardkhata only ever sees statements you send it.
• Saved profile secrets are optional, and you can remove them from your Profile.
• You can cancel your subscription from your Profile page at any time — access continues until the paid period ends, with no separate account deactivation.
• For a copy of your data or a deletion request, email support@cardkhata.in with the subject line “Privacy” from your account email.

If this policy changes in a way that matters, we will update this page and its “Last updated” date, and flag significant changes in the product. Continued use of cardkhata after a change means you accept the updated policy.

Questions about privacy, or about anything on this page: support@cardkhata.in. See also our Terms & Conditions and Refund & Cancellation Policy.